News
Microsoft Expands Defender Experts With New Threat Intelligence and Multicloud Coverage
Microsoft on Wednesday introduced a threat intelligence service and expanded its managed detection and response offering as the company looks to help security teams face growing volume of threat data into specific defensive actions.
The new Microsoft Defender Experts Threat Intelligence service will provide orgs with curated information about campaigns most likely to affect them. Microsoft is also expanding Defender Experts MDR with third-party and multicloud coverage powered by Microsoft Sentinel.
Aarti Borkar, corporate vice president of Microsoft Security, described the problem as an "intelligence-to-action gap" between recognizing a threat and determining how an organization should respond.
"That space between knowing a threat exists and acting on it is the intelligence-to-action gap, and it's where most breaches are won or lost," said Borkar in Microsoft's announcement.
Security teams already collect alerts from endpoints, identities, cloud workloads and third-party tools. But Microsoft says more feeds and dashboards do not always make it easier to identify the threats that matter most.
Defender Experts Threat Intelligence plans to cut through that noise with guidance from dedicated Microsoft security experts. Those specialists will compare global threat activity with each customer’s industry, location and technology environment, then recommend which risks to address first.
Customers will receive early warnings about relevant attacks, updates as threats change and regular briefings on geopolitical, industry and global risks. The service will also give executives a broader view of the threat landscape while providing security teams with technical steps they can take.
"The goal is simple: help you reduce risk before an attack reaches your environment, not explain what happened after the fact," Borkar said.
Microsoft didn't provide pricing, licensing details or a general availability date for the new threat intelligence service in its announcement.
Microsoft also announced an expansion of Microsoft Defender Experts MDR, formerly known as Defender Experts for XDR. The service will use Microsoft Sentinel to collect security signals from Microsoft and third-party products across cloud, identity, email, network and endpoint systems.
This broader view will help Microsoft’s security specialists track attacks as they move across different platforms. The service combines expert-built detections with automated investigation, response tools and guidance from Microsoft’s security team.
"With support for leading non-Microsoft sources across cloud, identity, email, network and endpoint environments, our experts can follow attacks wherever they move, not just where Microsoft products operate," Borkar wrote.
The expanded coverage will be sold as Defender Experts MDR Plan 2. Existing Defender Experts for XDR capabilities will continue without changes under the Defender Experts MDR Plan 1 name.
Plan 2 adds round-the-clock monitoring, cross-platform threat analysis and recommendations for improving security operations. Microsoft said the service will distill high-volume telemetry into prioritized incidents while providing a unified account of attacks spanning Microsoft and third-party environments.
Microsoft plans to demonstrate the new services at Black Hat USA. Pricing and availability for Defender Experts MDR Plan 2 should also be verified with Microsoft before publication.